The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads untrusted data from user conversation turns, file diffs, and session transcripts to generate rules that influence future agent behavior. This creates a risk where malicious or misleading instructions embedded in the conversation history could be codified into persistent project documentation or configuration.
Ingestion points: Conversation turns, file diffs, and JSONL transcripts stored in ~/.claude/projects/<project>/.
Boundary markers: The instructions lack explicit delimiters or warnings to ignore potentially malicious instructions embedded within the processed content.
Capability inventory: The skill writes to DESIGN.md, CLAUDE.md, AGENTS.md, and creates lint rules or test files. It is also capable of executing these generated checks across the codebase.
Sanitization: No sanitization or validation of the extracted "taste" corrections is performed before they are generalized into rules.
[DYNAMIC_EXECUTION]: The skill involves the generation and runtime execution of local code. In Phase 6, the agent is instructed to implement "checks" (such as lint rules or tests) based on inferred requirements and execute them against the project files.
[DATA_EXFILTRATION]: The skill is instructed to access and read session transcripts from ~/.claude/projects/<project>/. Although this is central to the skill's purpose of learning from past sessions, these files contain the complete history of interactions within a project, which may include sensitive information or code snippets shared during previous turns.

learn-taste